{"id":11169,"date":"2026-03-07T02:03:32","date_gmt":"2026-03-07T02:03:32","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/03\/07\/how-hackers-bypassed-mfa-with-a-120-phishing-kit-until-a-global-takedown-shut-it-down\/"},"modified":"2026-03-07T02:03:32","modified_gmt":"2026-03-07T02:03:32","slug":"how-hackers-bypassed-mfa-with-a-120-phishing-kit-until-a-global-takedown-shut-it-down","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/03\/07\/how-hackers-bypassed-mfa-with-a-120-phishing-kit-until-a-global-takedown-shut-it-down\/","title":{"rendered":"How hackers bypassed MFA with a $120 phishing kit \u2013 until a global takedown shut it down"},"content":{"rendered":"<p>    How hackers bypassed MFA with a $120 phishing kit \u2013 until a global takedown shut it down<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n    <!-- no image --><br \/>\n \t<BR><br \/>\n<BR><\/BR><\/p>\n<div>In a co-ordinated public-private operation between law enforcement agencies and cybersecurity industry partners, Tycoon 2FA &#8211; one of the world&#8217;s most prolific phishing-as-a-service platforms &#8211; has been dismantled.<\/p>\n<p>Read more in my article on the Hot for Security blog.<\/p><\/div>\n<p> \t<BR><br \/>\n <BR><\/BR><br \/>\n    Graham Cluley<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n<a href=\"https:\/\/www.bitdefender.com\/en-us\/blog\/hotforsecurity\/hackers-bypassed-mfa-120-phishing-kit-global-takedown-shut-down\">Go to grahamcluley<\/a><br \/>\n \t<BR><br \/>\n <BR><\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How hackers bypassed MFA with a $120 phishing kit \u2013 until a global takedown shut it down In a co-ordinated public-private operation between law enforcement agencies and cybersecurity industry partners, Tycoon 2FA &#8211; one of the world&#8217;s most prolific phishing-as-a-service platforms &#8211; has been dismantled. Read more in my article on the Hot for Security [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[398,54,155,164,124,2330],"tags":[71],"class_list":["post-11169","post","type-post","status-publish","format-standard","hentry","category-2fa","category-grahamcluley","category-guest-blog","category-law-order","category-phishing","category-tycoon-2fa","tag-grahamcluley"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11169"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=11169"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11169\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=11169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=11169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=11169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}